3.12. File Format Dependency Based on ExtensionSome viruses have extension dependency. Depending on the extension, a file might be placed in a different execution environment. A simple example of this is COM and BAT (ASCII) extension replacement. As a COM file, the file can function as binary. With a BAT extension, it looks like an ASCII BATCH file.Other common examples of this kind of dependency are as follows:
This method is often used as an attempt to confuse scanners about the type of object they are scanning. Because scanners often use header and extension information to determine the environment of the file, their scanning capabilities (such as heuristics analysis) might be affected if they do not identify the type of object properly.For example, PIF worms typically use mIRC, BAT, or even VBS combinations, based on extension dependency. A file with a PIF extension will function as a PIF. However, with a BAT extension, it will run as a BATCH instead, and the PIF section in the front of the file is simply ignored. Other examples include an mIRC and BATCH combination based on extension dependency tricks.Figure 3.12 demonstrates how the PIF is organized for extension dependency. The Phager virus uses the previously discussed technique. Figure 3.12. A high-level structure of a PIF with extension dependency. Zox is a direct-action overwriter virus. It overwrites INF files with itself. |
لطفا منتظر باشید ...
